The DLL Services component in Mozilla Firefox and Thunderbird can be abused to obtain privileges beyond those originally granted, enabling an attacker to perform privileged actions that compromise the integrity, confidentiality, and availability of the system. The weakness is an improper privilege management flaw, specifically a privilege escalation scenario that allows lower-level processes or code to elevate their rights.

This vulnerability affects Mozilla Firefox and Thunderbird across both Extended Support Release (ESR) and regular versions. It was confirmed to have been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 140.17, Thunderbird 157, Thunderbird 153.4, and Thunderbird 140.17. All releases older than these specific builds remain vulnerable.

The CVSS score of 8.8 classifies this vulnerability as high severity, while the EPSS score of < 1% indicates a very low probability of exploitation at this time. The flaw does not appear in the CISA KEV catalog, so no confirmed public exploitation has been reported. The likely attack vector, inferred from the nature of DLL Services, would involve local execution or manipulation of DLL loading to inject malicious code, although the precise conditions are not detailed in the description.